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Clinical Legal Education 

School of Law 


November 8, 2018 


VIA UPS OVERNIGHT MAIL 

Freedom of Information Act Request 

Phillip Hatcher 

Disclosure Manager 

Internal Revenue Service 

400 West Bay Street 

M/S 4030 

Jacksonville, FL 32202 

RE: KOI A Request Re: use of computer hacking tools for investigations 

Re(|uest No. K1K257-0012 

Dear Mr. Hatcher; 

We wrile on behalf of co-requestors Privacy International (“PI”), the American Civil 
liberties I Jnion, and the American Civil Liberties Union Foundation (together, the 
“ACLU”), and the Civil Liberties and Transparency Clinic of the University at Buffalo 
School of Law (“CLTC”), to respond to your agency’s October 4,2018, response letter to 
our September 10, 2018,1'leecknii of Information Act (“FOIA”) request (the “Raiuest”). 

By letter dated September 10, 2018, PI, ACLU, and CLTC requested from the 
Internal Revenue Service (“IRS”) copies of records related to the IRS’s use of computer 
hacking tools to conduct law enforcement investigations. The Request (attached hereto as 
Exhibit A) sought live spccilic categories of records, some of which included even more 
specilic sub-categories. It asked for expedited processing untler .*> U.S.C. § 552(a)(6)(E), and 
sought a limitation of fees and public interest fee wjiiver. 

As of today, we have received one letter in response to our Request to the IRS. That 
letter, dated October 4,2018 and signed by you, acknowledged receipt of our Request and 
purported to be a “final response” (attached as Exhibit B). The letter, however, did not 
provide any documents responsive to our request, nor did it cite any FOIA exemptions as a 
basis for refusing to disclose records.' Instead, the letter slalcti that the Request did not meet 
the requirements of FOIA and Treasury regulations because it did not “describe the 
documents [rcciuesledj in sufficient detail.” See Ex. B, at 2. Specifically, the letter denied 
item I of our Rapiest for failing to provide a contract number and items 2-5 on the basis 
they were not “reasonably tlescribcd.” See ul. The letter asked us to “consider revising four] 
request” to remedy this alleged deficiency. We have attempted multiple times to call 


' This letter is timely filed withm 35 days of receipt of Mr. Hatcher’s final response letter stating our 
request was not specific enough. We received that letter on October 4,2018. 

507 OBrian Hal, Buffalo. NY 14260-1100 
716.645.6222 (F) 716.645-2167 
jmmanes@buffalo.edu 


www.buffalo.edu 
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Disclosure Tax Law Specialist Bernard McDade, who was listed in the IRS letter as a point 
of contact, but we were unable to reach him. 

We disagree witi) the agency’s dclcnninalions denying (he Request. At (his lime, wc 
do not intend to revise the substance our Request, c.xccpt to add a spccitlc dale range, 
ilescribcd below. The Request, ;is writicn, iloes in fact properly describe the rceortls we 
seek, in compliance with the FOIA statute, governing ease law, and tlie cited IRS guidelines. 
The Request speeilleally identifies the categories ofrceorils wc seek with reference to tlie 
types ofdoeiiiuenLs, their tiinetion, and their siibjeet matter. Any person reasonably familiar 
with the subject matter ol'thc request—the use of computer hacking techniques by the IRS 
for piirpt)scs law enforcement —would be able readily to identify the responsive records. 
Indeed, the identical request submitteil to the IRS was subnutted to six other agencies. None 
ol'those agencies have refuscti to process the Request and none have suggested that it lacks 
a reasonable description ofthe records sought. 

To the extent that the Rc(|uest neglected to include a date range, we are glad to limit 
the request to doeiiments for a reasonable period. Wc would like to receive documents going 
back 10 yeai'S—from September 8, 2008 until the request is tilled—^luit are willing to 
discuss shorter ranges if that would signilicantly ease the burden on the agency or speed its 
response. 

As argued in detail below, the IRS cannot in this instance avoid its obligation under 
I'OIA, goveming case law, and its own regulations to coiuiuet a search lor responsive 
records and to disclose ail such materials that do not fall squarely within an exemption. We 
ask (he IRS immediately to proeess the Request as written, subject to the tiate range 
specilled above.’ 

A. PI. ACLU and CLTC followed FOIA and IRS guidelines by reasonably 
describina (he records soimht. 

PI, ACLU, and CLT’C! arc entitled to a substantive resjionse from the IRS because we 
have satisfied both the FOIA and the IRS requirements to describe the records we seek. 
According t<) the I'reedom of Information Act, agencies ofthe govermnent must make 
records “promptly available” upon any request for recorils which “(1) reasonably describe 
the records sought and (2) [is] made in accordance with published agency rules.” .‘i U.S.C. 

§ 552(3)(a). 

Under settled FOIA case law, the requirement to “reasonably describe” records is 
satis tied “if a professional employee of tlie agency familiar with the subject matter can 
locate the records with a reasonable amount of effort.” Scife v. Unilcd States Dep 7 of State, 
298 F. Supp. 3d .'>92, 611 (S.D.N.Y. 2018); see also, e.g., Goland v. CIA, 607 F.2d 339 
(D.C. Cir. 1978). 


^ We note that the October 4 letter did not indicate that it was subject to appeal, even though it was styled as a 
“final decision.” Under FOIA, if a detennination is subject to appeal, the agency must say so explicitly. 5 
U.S.C. § 552(a)(6)(A)(i)(III)(aa). We have therefore not directed this letter at the FOIA appellate authority. 
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treasury rcgiilalions, wliicli govern FRS’s I'OIA opcnilions, are iio( to tlie eoiUrary. 
Those regulations provide that the IRS must “make reasonably deseribed records available 
to a person making a request lor such records.” 26 C.r.R. § 601.702(c). ICtlic IRS 
determines that a request does not meet this standard, they “shall promptly advise the 
requester in what respect the request., .is deficient so tliat it may be rcsubiuitled or amended 
Ibr consideration.” Id. Importantly, the Treasuiy regidations state tliat the “reasonable 
de.scription requirement shall not be u.sed by officers or employees ol'the Internal Revenue 
as a device for improperly withliolding records (roin the public.” 26 C.F.R. 

§ 601.702(e){.5)(i). 

Treasury regulations fiirther provide that “no specific formula for a reasonable 
description of a record can be established.” 26 C.F.R. § 601.702 (c)(5)(i). The regulations 
list a number of factors that can be used to determine if the reasonableness is satisfied 
generally, including the name, subject matter, and location of records sought. See id. 
However, these are not inclusive factors aud failure to include any one of them doc.s not 
automatically mean the request has failed to reasonably describe the records sought. A 
request can have a reasonable description without including any of the factoi's listed in the 
Treasury regulations, since there is no specific formula. 

'fhe IRS has improperly rejected our Request under these standards. For item I, the 
IRS has stated as the basis for its refusal to process that the Request does not include 
specific contract numbers sought. See Ex. B. For items 2 through 5, the IRS has not 
specified why the requests do not meet the standards outlined above, other than to assert the 
possibility that a search for such records might be “burdensome.” See Ex. B. 

This respojise is unwarranted and unlawful. Our Request describes in rletail the 
subject matter and types of material we .seek. See Ex. A. In our R.et|uesl, we have asked for 
.specific types of documents relating to spceilie .subject matter mid whieh serve particular 
functions. We have now also agreed to a specific date range. A person familiar with the 
I RS’s u.se of computer hacking tools would have no trouble identifying what records are 
responsive. Among other thing.s, the request eonUiins a detailed, specific definition of 
“hacking techniques” and related terms, whieh was designed lo make il as elcar as possible 
what activities the request is focused on. See Ex. A, at 9. Each item of the Request then 
specifies particular types of records souglit that relate to hacking techniques, so defined. 

The first item of the Request breaks out five specific categories of responsive 
records; purchase orders and similar documents with vendors of hacking tools; policies, 
guidelines, legal opinions and/or rules that govern hacking techniques; non-disclosure 
agreements relating to hacking techniques; training materials, including materials fi'om 
conferences, courses, and workshtips; and marketing and promtitional materials regarding 
hacking techniques. Each of these subcategories of item I defines a discrete set of records 
that the IRS can readily identify. 

Items 2 through 5 of the Request are similarly specific. For example, item 2 details 
that it is seeks records that constitute “audits, assessments, or statistical reports” that relate 
tt> hacking techniques. Item 3 seeks “[rjecords reflecting internal approvals or 
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authorizations” to use hacking techniques as well as “standard forms, templates, checklists 
or similar documents that are used as part of any internal process(es) for obtaining approval 
to use hacking techniques.” Item 4 focuses on “'irjicenses, waivers, or agreenienls” witli 
other govcnuncnUil entities that concern hacking tcchni(|ues. And item 5 seeks 
coinnuinications with other law cnibrceinent agencies that contain two discrete search tenns 
“computer network exploitation” or “network investigative technique.” 

We crafted this Request in such a way as to assist the agency to identify the set of 
documents responsive to each item. See Ex. A. Emther, it is impossible for us to draw the 
Request more specifically, at least without more intimate knowledge of the Mnds of files 
that the IRS in fact keeps about hacking, and the organization of those files. We would be 
more than happy to work with agency officials to further specify and refine particular 
aspects of the Request in light of the manner in which the IRS actually maintains its records. 
But at this stage we lack sufficient information to be able to meaningfully narrow the 
request in ways that would assist the agency (except to provide a date range). 

The reasons that the IRS’s October 4 letter provides for refusing to process the 
Request do not withstand scrutiny and likely violate the Treasury regulations’ requirement 
to “advise the requester in what respect the request... is deficient.” 26 C.F.R. § 601.702(c) 
(emphasis added). With respect to items 2-5 of the Request and most of item 1, the IRS 
offered no explanation at all as to how or why the IRS regarded the Request as not 
reasonably described or unreasonably burdensome. It is therefore difficult or impossible to 
know how we could revise or narrow the Request in order to satisfy the agency. 

Furlhcrmorc, wi(h respect to item 1 of our Request, the IRS has provided a plainly 
inapplicable justification Ibr reliising to process. The letter sUites that the request is 
iiupi'opci because it does not contain a valid ll?S and/or Treasury contract number. This 
ol)jeelion miseonsliues our request and flatly ignores mueh of item 1. Only subsection (a) of 
item 1 involves LRS eontraets with other agencies or entities. There arc four other 
subsections that have nothing to do with contracts. 

Moreover, the purported requirement to itielude specific contract numbeis cannot 
reasonably be applied to our Request because the purpose of our request is to determine, in 
the first place, whether the IRS has eontraeted with providers of hacking technology. Based 
on publicly available information, we have not been able to determine whether these 
contracts exist, let alone identify contract nmnbers. As such, it is impossible for us to 
specify the particular eoniraet numbeis that might be responsive. Instead, to the extent that 
item I seeks eontraets, it has specified which eonlniets are responsive by reference to the 
detailed ilelliiitioii of “hacking leelmiiiues” and “equii>ment, sollware aiul/oi' teelmology that 
implements or facilitates hacking techniques” included in the request. (If, however, the IRS 
has actually published information about contracts numbers that would allow us to identify 
the specific ones relevant to our reiiuest, we would be glad to learn where we ean find sueh 
infonnation in order to make the request more precise.) 

Moreover, the provision of the IRS Manual that the letter eites, § 11 .."1.13.9.2.1, is 
focused primarily on providing contractors an opportunity to object to the rclesise of contract 
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records. IRS can provide its confracloi’s such an opporlunily without spcciilc contract 
numbers being listed in the Request. Moreover, even if the Request is “iinpert’eet” under the 
terms of the JRS Manual for lacking a specific contract number the IRS has no legsil 
authority to ignore the rest of item I, which asks tor far more information tlian just 
contracts, including: purchiuse orders, lease agreements, invt)ices, policies, guidelines, legal 
oi>inions, deployment or training jviaterials, and marketing and informational materials. St-c 
fix. A.’ 


As demonstiated above, our Request reasonably describes the records we arc 
seeking. Under the applicable provisions of TOT A, governing case law, and the treasury 
legulatioMs, we are entitled to a proper response from the IRS. We thus respectfully request 
that the IRS reevaluate our original Request and begin processing it as soon as possible, ’lb 
the extent tliat the I RS has specilied particular et)necrns about the scope of its res|X)nse to 
certain as|x:eLs of tlie reque.sl, we sUind ready U) discuss those with agency ofllcials. 

B. The IRS eaimot use tJic unreasonable burden standard to deny review of a 
reasonably described FOIA re(.|uest. 

1*1, At^LU, and CLTC arc entitled to a proper response from the IRS since the 
Request does not place an unrea.souable burden on the IRS. IRS regulations provide that 
requests should de.scribe docuiueuls in suflleient detail so that records can be located 
‘‘without placing an unreasonable burden upon the IRS.” 'I’reas. Reg. § 601.7()2(c)(.S)(i). 

The IRS’s October 4 letter suggests that the Request may impose such a l)urdcn but 
it offers no explanation as to how or why it would do so, nor how it could be revised or 
narrowed in order to avoid sueli a burden. An agency cannot simply refuse to review a FOIA 
request under the “unrea.sonable burden” standard without explaining the Imrdcns it will 
face. By contrast, in some cases courts have found that broad requests that seek “all records” 
or “every file” on an expansive subject matter can constitute an unreasonable burden. See 
Aonji; r. ICK, l‘) l'’.Supp..'Id 39, 5.5 (D.D.C. 2015). But we specifically avoided using such 
terms in our Request and limited our request to particular kinds of documents. An 
unreasonable burden can also exist if an agency hius to review, redact, or anange for 
inspection a vast quantity of material. Id. at 55-56 (citing Ant. h'ed'n ofCiov'f Emplt»yee.'i, 
Local 2782 v. U.S. Dept of Commerce, 907 F.2d 203, 209 (l).('. C’ir. 1990)). Here, the mS 
has failed to explain the tjuiuitity of material it would have to review. The letter simply 
stated that there was an unreasonable burden and rcfiised to review our Request without 
describing the number of documents the IRS would have to review. 

'I'lie IRS cannot, at such an early stage, rcfiise to consider our request under the 
unreasonable burden standard without describing the anticipated burden it would face and 


’ Moreover, it is not clear tliat tlie IRS eaii invoke its internal Manual as a liasis to ileny a reriiiest. Tlie Treasuty 
Department lias published formal mics regarding FOIA tliat do not eoutaiu any reiinirement to specify contnict 
nnniliers. Moreover, FOIA itself only autliorizes agencies to issue “rules stating the time, place, fees (if any), 
and procedures to Ik^ followeit” in making a request. It is iloubtful tliat an agency may evade FOIA obligations 
by invoking the autliority of an intcmal Manual tliat purfHirts to impose requirements not contemplated citlier 
by FOIA or duly promulgated agency regulations. 
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allowing ns llie opportunity to address any particularized concerns that s|iecific items ol'Uic 
request might ercale an unreasonable Inuden because oi', for example, the manner in which 
the IRS organizes is files or the volume of potentially responsive records. As noted above, 
we stand ready to work with agency officials to sharpen or narrow the Request, Init we can 
only meaningfully do so if we undershuul the specific nature of the IRS’s concerns. 

C. Tlie IRS has failed to process the Request in a timely manner. 

Tlic IRS l>as indicated that it intends to “administratively close” our Request il'we do 
not revise it. 'fhe IRS has also iusserted that the twenty-day statutory period for responding 
to the Request will not begin to mn until we have submitted a revised request. These 
responses are improper. TOIA conhiins no provisions that allows an agency to disregard a 
reciuest or stop the clock on its deadlines simply because llie agency asserts that tlie ret|uest 
does not “rea.sonably describe” the records sought. To the contraiy, the statute requires that 
“each agency, u|x>n request for records made under paragiaph (1), (2), or (3) of this 
subsection, shall... determine within 20 days after receipt of any such request whether to 
comply with such request and shall immediately notify the person making such request of 
such determination and the reasons thereof...” 5 U.S.C. § 5.52(a)(6)(A)(i). Here, the IRS 
has already passerl this twenty-day deadline and, in our view, is already in violation of FOIA 
for that reason. 

Moreover, while the October 4 letter purported to be a “final response” it did not 
provide the Requesters with an opportunity to appeal. Instead, it stated that the IRS “will be 
forced to close [the] request,” with apparently no opportunity to appeal. This, too, is 
contrary to FOIA, which requires agencies to give a requester the right to appeal in the event 
of any “adverse determination.” 5 U.S.C. § 552(a)(6)(A)(i)(Ill). As it stands, the letter 
appears to put Requesters in the untenable and unlawful position of being deprived of any 
opportunity to pursue their request as written. The IRS may not in this way deprive a 
requester of the appeal and review rights guaranteed by FOIA. 

In short, it is our position that die IRS is required lo search for responsive records 
and release them (or else provide an explanation tor withholding) as soon as possible, and 
that the twenty-day period for responding to requests has already hipsed. 

We would be glad to work with agency olfieials to refine the request if and when 
they encounter difficulties in processing. But without more information about the 
difficulties, if any, that the IRS would face in processing the request as written, we are 
unable meaningfully to revise the request, except to add a date nmge. 

For the foregoing reasons, we respectfully ask that the IRS begin processing the 
request immediately. We also ask that the IRS immediately grant our requests for expedited 
processing, a public interest fee waiver, and a limitation of fees. See Ex. A. 
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Please direet all eorrespondenee relating to this request to: 
Jonathan Manes 

Civil Liberties & Transpareney Clinie 
University at IJutTalo Scliool of Law 
507 O’Brian Hall, North Campus 
BulValo, NY 14260-1100 
(716) 645-6222 
imTnanes@bufiFalo.edu 

Tliank you for your prompt attention to this matter. 


Sincerely, 




Brett Max Kaulmun 
Vera Fiidelnian 

American CUvil Liberties Union 
Fouiulation 

125 Broatl Street, I Xth Moor 
New York, NY 10004 
bkaufmanCn)aclu.org 
veidehnan((7iaclu.org 


i/ I- 

Joiiathan Manes, supervising aHortuy 
Alex Hetschen, sltulcnl alltmuy 
R.f McDonald, student attorney 
Colton Kells, student attorney 
Civil l.iberties and Transpareney Clinic 
University at Bulfalo School of L.aw, 


SUNY 

507 O’Brian Hall, North Campus 
Bufllalo, NY 14260-1 KM) 

Tel: 716.645.6222 
jramancs@bufFalo.edu 


Jennifer Stisa Granick 

American Civil Liberties Union 

r'oundation 

.19 Drumm Street 

San Francisco, CA 94111 

Id: 415.143.0758 


Scarlet Kim 

Privacy International 

62 Britton Street 

London KCI M 5UY 

United Kingdom 

Tel: +44 (0)201 422 4121 

scarlet@privacyinternational.org 


jgranick@aclu.org 
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